What is the best way of a parsing extension to ignore when a field doesn't exist within the raw log?

I’ve been using a similar approach to how the normal parsers do it. E.g. setting it to “” in the top part of the parser. Then relying on != in the if statement

The below is hopefully a really basic instructive example:

filter {
mutate {
replace => {
"message.important.field" => ""
}
}

if [message] != "" {
json {
source => "message"
array_function => "split_columns"
on_error => "not_json"
}
}
if [message][important][field] != "" {
mutate {
replace => {
"DO STUFF HERE"
}

}
mutate {
merge => {
"@output" => "event"
}
}
}
}

Note merging the event happens in the if statement. If you leave it outside of the if statement then event will be empty when you try to merge it into output. It feels like a hack, but I haven’t seen best practice guidance for this

That might be my issue, my merge is outside the if statement. Will try this thank you.

Thank you. That fixed the issue I was having.